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DETAILED ACTION 
Continued Examination under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1 .17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 1 1/25/2009 has been entered. No claim is 
amended. Claims 1-20 are currently pending. 

2. Amendment received on 04/30/2009 was entered into record. Claims 1, 12 and 17 were 
amended. 

3. Applicant's submission filed on 02/09/2009 was entered. The amendment to the 
specification to change the title of application was reviewed and accepted. Claims 1,12 and 17 

were amended. 

4. Amendment received on 08/20/2008 has been entered into record. Claims 1, 12-13 and 
17-20 are amended. 

Priority 

5. This application has claimed priority from provisional application 60528643 filed on 
12/10/2003. The filing date is 03/30/2004. 
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Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject matter 
sought to be patented and the prior art are such that the subject matter as a whole would have 
been obvious at the time the invention was made to a person having ordinary skill in the art 
to which said subject matter pertains. Patentability shall not be negatived by the manner in 
which the invention was made. 

Claims 1-9 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley et al. (US 
7277957 B2), hereinafter referred as Rowley and fiirther in view of Saulpaugh et al. (US 
7072967 Bl), hereinafter referred as Saulpaugh. 

a. Rowley shows (claim 1) an apparatus (Fig. 1 and Fig. 2) comprising: a network 
interface module to connect the apparatus to a network (column 3, lines 28-33; 
Ethemet card as a network tap device); a packet capture module to intercept packets 
being transmitted on the network (column 3, lines 33-35: a packet capture engine); an 
object assembly module to reconstruct flows representing objects being transmitted 
on the network from the intercepted packets (column 4, lines 9-12: packets are 
sequentially read, decoded, checked and added to the protocol sorted list until the last 
packet has been retrieved; column 4, lines 29-34: data fi-om the selected packets may 
be reconstructed into data files and script files used to display web pages and other 
content; column 6, lines 59-65: local cache holding word processing documents, PDF 
files, audio files and video files), the packets associated with a document (column 4, 
lines 29-34: packets reconstructed into data and script files for web pages and other 
contents), wherein objects are captured based on a capture rule that specifies the 
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objects, and wherein a determination is made as to whether to discard or to store the 
objects (column 3, lines 62-67: packet not needed for the subsequent reconstruction 
of the network communication session); an object classification module to determine 
a type of content of (column 4, lines 63-65: determine the type of packets; column 6, 
lines 6-11: packet indicates a script file type to be displayed as page, e.g. HTML, Java 
Script and Active Server Pages; multi-packet recompilation module set similar 
directories for local cache of files) and reconstruct objects fi-om flows (column 4, 
lines 9-12: packets are sequentially read, decoded, checked and added to the protocol 
sorted list until the last packet has been retrieved; column 6, lines 59-65: local cache 
holding word processing documents, PDF files, audio files and video files); an object 
store module to store the objects (column 4, lines 9-12: packets are sequentially read, 
decoded, checked and added to the protocol sorted list until the last packet has been 
retrieved); and a user interface to enable a user to search objects stored in the object 
store module (column 7, line 66-column 8, line 1 : web browser or display program 
capable display text, graphic and other visual information on a computer monitor). 
Rowley does not explicitly show (claim 1) the document includes the objects; 
wherein the objects are searched based a query, which includes search criteria used to 
identify selected objects that match the search criteria. Rowley does show (claim 1) 
bowever using browser to search and identify objects based upon search criteria 
seems to be known to one skill in the art. 
b. Saulpaugh shows reconstructing objects fi-om XML data stream (column 82, lines 28- 
52); search based on search criteria (column 33, line 55-column 34, line 3); database 
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query based upon name or strings (column 41, line 60-coIumn 42, lines 10); query 
results cache (column 48, lines 33-52); and search tag may contain optional set of 
search criteria (column 64, line 10-column 65, line 9) in an analogous art for the 
purpose of efficient construction of message endpoints. 

nwosi'so: . ^ i>\Klo ;o Rowley's functions of reconstructing network 

communications wdth Saulpaugh's fimctions of reconstructing objects from XML 
data sfream and message query based on name or string. 

\\0'aia !ijL\ , ivci- iJO-...\ .•.t,.a tv- data selection or query based on name or string as per 
Saulpaugh's teaching in support the display of data collected and reconstructed as per 
Rowley (column 1, lines 54-65) and Saulpaugh (column 82, lines 28-52)'s teaching. 

e. Regarding claim 2, Rowley shows wherein the object assembly module comprises a 
reassembler to assemble the intercepted packets into flows (column 4, lines 9-12: 
packets are sequentially read, decoded, checked and added to the protocol sorted list 
until the last packet has been retrieved; column 6, lines 59-65: local cache holding 
word processing documents, PDF files, audio files and video files). 

f. Regarding claim 3, Rowley .shows wherein the object assembly module further 
comprises a protocol demultiplexer to sort the assembled flows by protocol (column 
4, lines 9-12: packets are sequentially read, decoded, checked and added to the 
protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
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local cache holding word processing documents, PDF files, audio files and video 
files). 

g. Regarding claim 4, Rowley shows wherein the object assembly module further 
comprises a protocol classifier to extract the objects from the sorted assembled flows 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

h. Regarding claim 5, Rowley shows wherein the object classification module 
determines whether objects are stored in the object store or discarded based on one or 
more capture rules (column 3, lines 62-67: packet not needed for the subsequent 
reconstruction of the network conmiunication session). 

i. Regarding claim 6, Rowley shows wherein the capture rules are user-configurable 
through the user interface (column 1, line 66-column 2, line 9: selecting a portion of 
the packets captured by a sniffer during a giving time interval; column 3, lines 43-47: 
selecting captured data during a specified time interval). 

j. Regarding claim 7, Rowley shows wherein the object classification module 

determines a location that each object is stored in the object store based on the type of 
content of each object (column 6, lines 38-48: directory structure based on image file 
type; column 6, lines 49-65: directory structure for graphics files, text files, audio 
files and video files). 
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k. Regarding claim 8, Saulpaugh shows wherein the object classification module 

determines the type of content of each object using a signature of each object (column 
82, lines 28-52: an object signature may be included to identify the object's class). 
1. Regarding claim 9, Rowley shows wherein the user interface comprises a graphical 
user interface (column 7, line 66-column 8, line 1 : web browser or display program 
capable display text, graphic and other visual information on a computer monitor). 
Together Rowley and Saulpaugh disclosed all limitations of claims 1-9. Claims 1-9 are 
rejected under 35 U.S.C. 103(a). 
7. Claims 10-11 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley, 
Saulpaugh and further in view of Bamett et al. (US 7290048 Bl), hereinafter referred as Bamett. 

a. Rowley shows claim 1 as above. Neither Rowley nor Saulpaugh shows (claim 10) 
wherein the object store module comprises a content store to store the objects and a 
lag store to index the objects stored in the object store. Ilowever, Rowley does show 
identifying protocol and collecting packets into a protocol sorted list; selecting, 
reconstructing and displaying data information, e.g. web pages, from a protocol 
session. 

b. Bamett shows (claim 10) wherein the object store module comprises a content store 
to store the objects and a (ag store to index the objects stored in the object store 
(column 10, lines 52-61: tags and other columns support transaction recognition, 
pointer to original sources of data for traceability; column 22, lines 18-37: tags 
interpreted are time, data, file name, line numbers, graph object types, source, 
destination and tool tip information) in an analogous art for the purpose of data 
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collection, data analysis, and model generation for the performance analysis of 
enterprise applications. 

c. It would have been obvious to a person of ordinar>'' skill in the an at the time of the 
invention was made to modify Rowley's functions of reconstructing network 
communications with Saulpaugh's functions of message query based on name or 
string and Bamett's functions of using tags in support of performance analysis. 

d. The modification would have been obvious because one of ordinary skill in the art 
would have been moiivated to tag and identify data as per Bamett's teaching in 
support the data collection and reconstruct as per Rowley (column 1 , lines 54-65), 
Saulpaugh (column 82, lines 28-52) and Bamett (column 7, lines 35-45)'s teaching. 

e. Regarding claim 11, Bamett shows wherein the content store comprises a canonical 
storage, and the tag store comprises a database (column 12, lines 4-12: canonical 
form for abstract module, sources supply lines information form text file, binary file 
or database; colimm 13, lines 26-48: data consists of network traces consisting of 
arrays mutated into hash tables to be addresses by column header vs. row and column 
locations). 

Together Rowley, Saulpaugh and Bamett disclosed all limitations of claims 10-11. Claims 
10-11 are rejected under 35 U.S.C. 103(a). 
8. Claims 12-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley in 
view of Saulpaugh and Bamett. 

a. Rowley shows (claim 12) an method comprising: intercepting data being transmitted 
on a network (column 3, lines 33-35: a packet capture engine); reconstmcting flows 
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of objects being transmitted on the network from the intercepted data (column 4, lines 
9-12: packets are sequentially read, decoded, checked and added to the protocol 
sorted list until the last packet has been retrieved; column 4, lines 29-34: data from 
the selected packets may be reconstructed into data files and script files used to 
display web pages and other content; column 6, lines 59-65: local cache holding word 
processing documents, PDF files, audio files and video files); classifying the 
reconstructed objects by content type (column 4, lines 63-65: determine the type of 
packets; column 6, lines 6-11: packet indicates a script file type to be displayed as 
page, e.g. HTML, Java Script and Active Server Pages) ), the data associated with a 
document (column 4, lines 29-34: packets reconstructed into data and script files for 
web pages and other contents), wherein objects are captured based on a capture rule 
that specifies the objects, and wherein a determination is made as to whether to 
discard or to store the objects (column 3, lines 62-67: packet not needed for the 
subsequent reconstruction of the network communication session; and storing the 
classified objects (column 4, lines 9-12: packets are sequentially read, decoded, 
checked and added to the protocol sorted list until the last packet has been retrieved). 
Rowley does not show (claim 12) the document includes the objects; creating a tag to 
describe each reconstructed object; storing tags; indexing the stored objects to enable 
searching of the stored objects via the tags; and wherein the objects are searched 
based on a query, which includes search criteria used to identify selected objects that 
match the search criteria. However, Rowley does show identifying protocol and 
collecting packets into a protocol sorted list as per IP address and port number to 
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categorize packets (column 4, lines 42-65); selecting, reconstructing and displaying 
data information, e.g. web pages, from a protocol session, including the directory and 
file structures (column 7, lines 37-51). 

b. Bamett shows (claim 12) creating a tag to describe each reconstructed object; storing 
tags; storing tags; indexing the stored objects to enable searching of the stored objects 
via the tags (column 10, lines 52-61: tags and other columns support transaction 
recognition, pointer to original sources of data for traceability; column 22, lines 18- 
37: tags interpreted are time, data, file name, line numbers, graph object types, 
source, destination and tool tip information) ip --i; .5!^^)- .-^^o^ as i ibo pinp-'is.-^ <n' 
data collection, data analysis, and model generation for the performance analysis of 
enterprise applications. 

c. Saulpaugh shows reconstructing objects from XML data sfream (column 82, lines 28- 
52); search based on search criteria (column 33, line 55-column 34, line 3); database 
query based upon name or strings (column 41, line 60-column 42, lines 10); query 
results cache (column 48, lines 33-52); and search tag may contain optional set of 
search criteria (column 64, line 10-column 65, line 9) in an analogous art for the 
purpose of efficient construction of message endpoints. 

d. It would have been obvious to a person of ^■♦idtnai ^ s ■ ' ' o 'bo 
in V en don was made to n-odily Rowley's ftinctions of reconstructing network 
communications with Saulpaugh's fimctions of reconstructing objects from XML 
data sfream and message query based on name or string and Bamett' s functions of 
using tags in support of performance analysis. 
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e. The modification would have been obvious because one of ordinary skiil in the art 
would have been motivated to tag and identify data as per Bamett's teaching in 
support the data collection and reconstruct as per Rowley (column 1, lines 54-65), 
Saulpaugh (colunm 82, lines 28-52) and Bamett (column 7, lines 35-45)'s teaching. 

f. Regarding claim 13, Rowley shows wherein reconstructing the objects comprises: 
sorting the intercepted data into packets; and sorting the assembled flows by protocol 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

g. Regarding claim 14, Rowley shows fiirther comprising determining whether each 
object is to be stored based on a set of one or more capture rules (column 3, lines 62- 
67: packet not needed for the subsequent reconstruction of the network 
communication session). 

h. Regarding claim 15, Saulpaugh shows further comprising receiving a query over the 
stored objects (column 27, lines 10-29: query for a message response). 

i. Regarding claim 16, Saulpaugh - n further comprising searching the indexed 
objects, and retrieving objects matching the query (column 41, line 60-column 42, 
lines 10: database query based upon name or strings; column 48, lines 33-52: query 
results cache); 

j. Regardmg claim 17, Rowley shows an machine-readable storage medium having 
stored thereon data representing instructions (Fig. 1 and Fig. 2) that, when executed 
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by a processor, cause the processor to perform operations comprising: intercepting 
data being transmitted on a network (column 3, lines 33-35: a packet capture engine); 
reconstructing objects being transmitted on the network from the intercepted data 
(column 4, lines 29-34: data from the selected packets may be reconstructed into data 
files and script files used to display web pages and other content); classifying the 
reconstructed objects by content type (column 4, lines 63-65: determine the type of 
packets; column 6, lines 6-11: packet indicates a script file type to be displayed as 
page, e.g. HTML, Java Script and Active Server Pages), the data associated with a 
document (column 4, lines 29-34: packets reconstructed into data and script files for 
web pages and other contents) identifying characteristic of the document (column 5, 
lines 28-37: indicates a file with characteristics), wherein objects are captured based 
on a capture rule that specifies the objects, and wherein a determination is made as to 
whether to discard or to store the objects (column 3, lines 62-67: packet not needed 
for the subsequent reconstruction of the network communication session); and storing 
the classified objects (column 4, lines 9-12: packets are sequentially read, decoded, 
checked and added to the protocol sorted list until the last packet has been retrieved). 
Bamett shows creating a tag to describe each reconstructed object; storing tags; 
storing tags; indexing the stored objects to enable searching of the stored objects via 
the tags (column 10, lines 52-61: tags and other columns support transaction 
recognition, pointer to original sources of data for traceability; column 22, lines 18- 
37: tags interpreted are time, data, file name, line numbers, graph object types, 
source, destination and tool tip information). Saulpaugh shows reconstructing objects 
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from XML data stream (column 82, lines 28-52); search based on search criteria 
(column 33, line 55-column 34, line 3); database query based upon name or strings 
(column 41, line 60-column 42, lines 10); query results cache (column 48, lines 33- 
52); and search tag may contain optional set of search criteria (column 64, line 10- 
column 65, line 9). Claim 17 is of substantially same scope as claim 12. Thus the 
reasoning and motivation to combine of Rowley, Saulpaugh and Bameet as applied to 
claim 12 apply to claim 17. 
k. Regarding claim 1 8, Rowley shows wherein reconstructing the objects comprises: 
sorting the intercepted data into packets; and sorting the assembled flows by protocol 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

1. Regarding claim 19, Rowley shows wherein the instructions further cause the 
processor to determine whether each object is to be stored based on a set of one or 
more capture rules (column 3, lines 62-67: packet not needed for the subsequent 
reconstruction of the network communication session). 

m. Regarding claim 20, Saulpaugh shows wherein the instructions further cause the 
processor to receive a query over the stored objects, search the indexed objects in 
response to the query, and retrieve objects matching the query (column 27, lines 10- 
29: query for a message response; column 41, line 60-column 42, lines 10: database 
query based upon name or strings; column 48, lines 33-52: query results cache). 
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Together Rowley, Saulpaugh and Bamett disclosed all limitations of claims 12-20. Claims 
12-20 are rejected under 35 U.S.C. 103(a). 
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Response to Arguments 

9. Applicant's arguments filed on 1 1/25/2009 have been fully considered, but they are not 
persuasive. 

a. Applicant did not amend claim set. Applicant has repeated a similar argument as per 
3'^'^ paragraph on page 8 through last paragraph on page 9 of a previous amendment 
received on 10/20/09 (see last paragraph on page 8 through last paragraph on page 9 
of current amendment). An Advisory Action was issued on 1 1/09/2009 in response to 
the argument as per previous amendment. 

b. Examiner has reviewed the argument and found that Rowley has further described 
(column 1, line 66-column 2, line 9) selecting a portion of the packets captured by a 
sniffer during a giving time interval. Rowley has described (column 4, lines 29-34) 
that packets selected, captured and sorted into the protocol sorted list, the data from 
the selected packets are reconstructed into data and script files for web pages and 
other contents. Rowley has described (column 3, lines 62-67) packet not needed for 
the subsequent reconstruction of the network communication session is not included 
in the protocol sorted list, e.g. DN lookup request packets, error packets or corrupted 
packets. Rowley has taught and suggested some rule is applied to select, capture and 
store the packets for the reconstruction of network communication session. Saulpaugh 
on reconstructing objects from XML data sfream (column 82, lines 28-52) and from 
Rowley on packets reconstructed into data and script files for web pages and other 
contents (column 4, lines 29-34), together Rowley and Saulpaugh have disclosed the 
argued limitation. The ability to identify the contents to be captured is well known 
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and disclosed by Rowley and Saulpaugh as applied to reconstruct objects from XML 
data stream per Saulpaugh' s teaching and are also disclosed as a filter fimction 
specified in Chapter 3 with specific filer fields definitions for various known 
protocols in Appendix A of Applicant's IDS (received on 08/20/2008) item 
"Etherreal User's Guide". Examiner has also searched and found that Rowley has 
described (column 1, lines 24-35, column 6, lines 49-65 and column 7, line 66- 
column 8, line 7) reconstructing a network communication session with web 
browser's cache containing various files, e.g. audio and video binary object files. 
Examiner has further noticed that applicant's claim 4 has specifically mentioned 
using protocol classifier to extract the objects from the sorted assembled flowed as 
disclosed by Rowley (column 4, lines 9-12: packets are sequentially read, decoded, 
checked and added to the protocol sorted list until the last packet has been retrieved ; 
column 6, lines 59-65: local cache holding word processing documents, PDF files, 
audio files and video files). 
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Conclusion 

10. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Refer to the enclosed PTO-892 for details. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Peling A. Shaw whose telephone number is (571) 272-7968. The 
examiner can normally be reached on M-F 8:00 - 4:00. 

If attempts to reach the examiner by telephone are unsuccessfiil, the examiner's 
supervisor, William C. Vaughn can be reached on (571) 272-3922. The fax phone number for 
the organization where this application or proceeding is assigned is (571) 273-8300. 

Information regarding the statu9s of an apphcation may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Elecfronic Business Center (EBC) at 866-217-9197 (toll-free). 



/Peling A Shaw/ 
Examiner, Art Unit 2444 



